validation

var (
	// ValidThreatModelFrameworks are the allowed threat modeling frameworks
	ValidThreatModelFrameworks = []string{"CIA", "STRIDE", "LINDDUN", "DIE", "PLOT4ai"}

	// ValidDiagramTypes are the allowed diagram types
	ValidDiagramTypes = []string{"DFD-1.0.0"}

	// ValidAssetTypes are the allowed asset types
	ValidAssetTypes = []string{"data", "hardware", "software", "infrastructure", "service", "personnel"}

	// ValidRepositoryTypes are the allowed repository types
	ValidRepositoryTypes = []string{"git", "svn", "mercurial", "other"}

	// ValidRoles are the allowed access roles
	ValidRoles = []string{"owner", "writer", "reader"}

	// ValidSubjectTypes are the allowed subject types for access control
	ValidSubjectTypes = []string{"user", "group"}

	// ValidWebhookStatuses are the allowed webhook subscription statuses
	ValidWebhookStatuses = []string{"pending_verification", "active", "pending_delete"}

	// ValidWebhookDeliveryStatuses are the allowed webhook delivery statuses
	ValidWebhookDeliveryStatuses = []string{"pending", "delivered", "failed"}

	// ValidWebhookPatternTypes are the allowed webhook URL deny list pattern types
	ValidWebhookPatternTypes = []string{"glob", "regex"}

	// ValidEntityTypes are the allowed metadata entity types
	ValidEntityTypes = []string{"threat_model", "threat", "diagram", "document", "repository", "cell", "note", "asset", "survey", "survey_response", "team", "project"}

	// EveryonePseudoGroupUUID is the reserved UUID for the "everyone" pseudo-group
	EveryonePseudoGroupUUID = "00000000-0000-0000-0000-000000000000"

	// SecurityReviewersGroupUUID is the well-known UUID for the Security Reviewers group.
	SecurityReviewersGroupUUID = "00000000-0000-0000-0000-000000000001"

	// AdministratorsGroupUUID is the well-known UUID for the Administrators built-in group.
	AdministratorsGroupUUID = "00000000-0000-0000-0000-000000000002"

	// ConfidentialProjectReviewersGroupUUID is the well-known UUID for the Confidential Project Reviewers group.
	ConfidentialProjectReviewersGroupUUID = "00000000-0000-0000-0000-000000000003"

	// TMIAutomationGroupUUID is the well-known UUID for the TMI Automation built-in group.
	TMIAutomationGroupUUID = "00000000-0000-0000-0000-000000000004"

	// EmbeddingAutomationGroupUUID is the well-known UUID for the Embedding Automation built-in group.
	EmbeddingAutomationGroupUUID = "00000000-0000-0000-0000-000000000005"
)

var BuiltInGroupUUIDs = []string{
	EveryonePseudoGroupUUID,
	SecurityReviewersGroupUUID,
	AdministratorsGroupUUID,
	ConfidentialProjectReviewersGroupUUID,
	TMIAutomationGroupUUID,
	EmbeddingAutomationGroupUUID,
}

var (
	// MetadataKeyPattern is the single metadata key rule; it must match the
	// OpenAPI Metadata.key pattern. Length (1-256) is checked separately.
	MetadataKeyPattern = regexp.MustCompile(`^[a-zA-Z0-9_./:-]+$`)
)